Privacy Policy

1. Who is responsible

In this policy, “Verquil” and “we” mean Verquil, the operator of this service and the controller of the personal data described here. Contact: hello@verquil.com.

2. What we collect

• Account data: your email address and, if you have set one, a securely hashed password.
• Sign-in identifier: if you sign in through a sign-in provider instead of a password, the identifier that provider uses for your account, so that we recognise you the next time you sign in, together with when that link was created and when you last used it. We keep this until you close your account. We do not ask that provider for your name or your profile picture, and we do not keep them.
• Your files: the video or audio you upload, the audio we extract from it, and the transcripts we produce.
• AI output: the summaries we write and the working drafts we produce from your transcripts, stored alongside the original speech-to-text output rather than replacing it.
• Checkout records: when you start buying credits and we successfully open a checkout with the payment provider, we store which credit pack you selected, the identifier that provider gave that checkout, and the time, so that we can tell when our payment flow breaks. We keep these for 30 days; an automatic cleanup that runs every few minutes removes them once they are older than that, and closing your account deletes them immediately.
• Usage records: your credit ledger (reservations, settlements, refunds), job metadata such as file duration, language, status, and failure reasons.
• Custom vocabulary: the terms you add to improve accuracy.
• Technical logs: standard server logs (IP address, timestamps, requested pages) kept for security and troubleshooting.

We do not use advertising trackers or sell personal data.

3. How long we keep your audio and video

• Source video: the file you upload is deleted from our servers as soon as the audio has been extracted from it, whether or not the transcription then succeeds.
• Audio: the audio extracted from your file is kept for up to 30 days after upload so you can play it back while reviewing the transcript. After that it can no longer be played back, and our automatic cleanup removes the file (we monitor that cleanup and are alerted if it falls behind). You can delete it earlier from the transcript page whenever no transcription of that recording is still running.
• This applies to successful and failed transcriptions alike: a failed job can be retried from the same audio for as long as it is kept, without re-uploading.
• Transcripts: your transcripts stay in your account so you can review and export them, until you delete them or close your account. Your transcript, including word-level timing and confidence values from the speech-to-text engine, is kept until you delete it.
• Provider output: the speech-to-text provider returns your transcript together with a machine-readable copy of its raw output (the same words, plus timing and confidence details). We keep that raw copy for up to 7 days so we can investigate a problem with a transcript if you report one, then delete it automatically. Your transcript itself is unaffected.
• Staff access: our staff can access your transcript content only when strictly necessary to support you or investigate a problem, and every such access is recorded in an audit log. Those audit records are kept for up to 24 months and then deleted; like all data, copies in our rolling backups age out within a further 30 days.

4. Who else processes your data

Verquil runs on a small number of providers that process data on our behalf. By category, they are:

• a speech-to-text provider, which receives the audio extracted from your files and returns the transcript;
• an AI provider, which receives transcript text when we write a summary or draft the transcript for readability;
• an email provider, which receives your email address and the contents of account email (verification links, password resets, service notices) — it never receives your recordings or your transcripts;
• a hosting provider, which runs the servers where your account, your transcripts, and your audio for as long as we keep it live.
• a payment provider, which acts as the merchant of record when you buy credits: it receives your email address and the details of the purchase, and collects your payment details directly — we never see your card number;
• an object-storage service operated by a U.S. company, which holds encrypted-in-transit daily database backups (account and transcript data) for up to 30 days before they are rotated out.
• an analytics provider, which counts visits to our public pages — never the workspace you sign in to. When it is running, its script sends that provider the address of the page you are on, the address you came from, and page-loading performance measurements; its servers also receive your IP address, as any server does when your browser contacts it. According to that provider (we last verified this on 2026-09-06), the script does not set cookies or read any storage on your device, and the service discards your IP address at the nearest of its data centres instead of storing it. It handles this data at whichever of its data centres your request reaches, which may be outside your own country, and it does not publish how long it keeps it; the reports we can see cover the past six months.
• a bot-detection provider, which checks that our sign-up, sign-in, password-reset and verification-email forms are being filled in by a person rather than by a script. When it is switched on, those four forms load a script from that provider, so your browser contacts it directly from them; our server then sends that provider the result of a check together with the IP address the request came from, so it can confirm whether the check passed. It is not used anywhere else in the service, and it never receives your recordings or your transcripts. According to that provider (we last verified this on 2026-09-07), the signals it collects include your IP address, the fingerprint of the encrypted connection your browser makes, the browser identification it sends, and the identifier of the check we installed together with the site it was shown on; it states that it cannot directly identify individuals from them, it does not publish how long it keeps them, and it offers no way to keep this processing inside a chosen region, so we cannot tell you which country it happens in.

Visit counting is running at the moment, on our public pages only.

The bot check is running at the moment, on the signed-out account pages only.

Except for the payment provider and the bot-detection provider, they process data only on our instructions, to provide their service. The payment provider, as merchant of record, is an independent controller of the transaction data it collects (for tax, invoicing and record-keeping duties of its own) and handles it under its own privacy policy. The bot-detection provider acts on our instructions when it checks one of our forms, and is at the same time an independent controller of the same signals when it uses them to improve the bot detection it offers to every site that uses it, under its own privacy policy. The text-processing, email, hosting, and payment providers process data in the United States; our servers are in Los Angeles. What the speech-to-text provider says about where it processes your audio is set out below, with the date we last checked it.

Signing in through a sign-in provider is optional and works differently: that provider is not processing data on our behalf. If you choose it, your browser goes to the provider, the provider learns that you signed in to Verquil, and it returns your account identifier and your verified email address; we do not ask it for your name, your profile picture, or any other profile information. We keep only what the list of collected data above says we keep; anything else it sends is discarded during sign-in and is not retained. The provider never receives your files or your transcripts, and it handles your account with it under its own privacy policy, as an independent controller. Once signed in, you can set a password in your account settings and then sign in with your email address instead.

See the list of providers by name

Transcription is performed by a speech-to-text provider. To transcribe a file, we transmit the extracted audio to that provider over an encrypted connection.

• Training opt-out is enforced on every request: our system attaches the opt-out flag automatically, built into the only code path that can reach the provider, so it cannot be forgotten or disabled per request. Your audio is not used to train models.
• According to that provider (we last verified this on 2026-09-12), it has been audited under SOC 2 Type II, and for requests that opt out of its model-improvement programme — which every request we send does — it keeps the audio only for as long as it takes to process that request and does not use it to train its models. It offers a guarantee about the country processing happens in only through its European and Australian regional endpoints, and we use its default global endpoint, so we cannot tell you which country any single request is processed in. These are the provider's own statements, not our commitment, and they can change.

Cross-border transfer: transcribing a file means your audio is sent to that provider, a company based in the United States, and, as described above, we cannot tell you which country it is processed in; the copy we keep for playback stays on our own servers.

5. AI summaries and AI-drafted transcripts

For any language, we can write a short summary of what a recording covers, and, where we can, we draft the transcript you work with for readability. Drafting happens once, when the transcript is produced; it is not always available. All of these are produced by a text-processing provider on servers located in the United States.

To do this we send the full text of your transcript to that provider — not an excerpt, and not anonymized. Your audio is never sent.

Summaries and AI drafts are written by software and can be wrong or incomplete. They are labelled as AI-generated wherever they appear. The original speech-to-text output is stored as the engine produced it, apart from whitespace normalisation, and is never rewritten. The AI draft adds punctuation, corrects obvious recognition errors, removes filler words and tidies sentences, so it can change wording and occasionally meaning; after drafting, only you change it. Review the draft against the original before relying on it; the original stays available unchanged for as long as you keep the transcript.

The provider's commercial terms state that it does not train its models on customer content, and its published policy states that inputs and outputs are deleted within 30 days of being received or generated, with exceptions it publishes: content its automated systems flag as violating its usage policy is kept for up to two years, and it may keep data for longer where the law requires, where it needs to act on such violations, or in anonymised form for research. We last verified these terms on 2026-09-08; they are the provider's terms, not our commitment, and can change. So a copy of your transcript text exists on that provider's systems — normally for up to 30 days, and for longer in the exceptional cases just described.

6. How we use your data

• To provide the service: transcribe your files, apply your vocabulary, meter credits, deliver results, and keep your audio for up to 30 days so you can play it back while reviewing the transcript.
• To operate your account: sign-in, verification email, password resets, and important service notices.
• To keep the service safe: security monitoring, abuse prevention, and troubleshooting.
• To understand how our public pages are found and used: aggregate visit counts for those pages.

We do not use the content of your recordings or transcripts for marketing, profiling, or training.

7. Cookies

We use only the cookies needed to run the service: a session cookie to keep you signed in, a security (CSRF) cookie, and a language preference cookie. No advertising or third-party analytics cookies.

Counting visits to our public pages does not use cookies either. The workspace you sign in to is never counted, and while you are signed in we do not count your visits at all.

8. Security

Data is encrypted in transit (HTTPS/TLS), both between you and Verquil and between Verquil and the providers described above. Passwords are stored as salted hashes, never in plain text. Access to production systems is restricted, and audio is removed by an automatic cleanup at the end of its retention period, which we monitor.

9. Your rights

You can access and export your transcripts from your account at any time, delete individual transcripts, and close your account from Settings. Deleting a transcript removes its text and the recording from our servers, and you can also delete just the recording from the transcript page; closing your account does that for everything in it, anonymises your account, and signs you out. In normal operation, copies inside our rolling backups age out automatically within 30 days. In the rare event that we must restore from a backup after a failure, content deleted after that backup was taken may reappear; where our records allow us to identify such deletions, we will apply them again as part of the recovery. Records of credit purchases and usage are kept because we are required to keep billing records, and are no longer linked to your email. Depending on where you live, you may also have legal rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise them, contact us and we will respond within the timelines required by applicable law.

10. Changes to this policy

If we change this policy in a way that matters — especially anything affecting the retention promises above — we will notify you before the change takes effect, and files you have already uploaded stay under the deletion rules that applied when you uploaded them.

11. Contact

Privacy questions or requests: hello@verquil.com.